For a simple way to refuse (in the code) all the requests that are not from Cloud Tasks for my firebase v2 function.
<code>export const createSomethingHttp = onRequest(async (request, response) => {
// Check if the request is from Cloud Tasks
if (!request.headers['x-cloudtasks-queuename']) {
logger.error('Request not from Cloud Tasks', request.headers);
response.status(403).json({ error: 'Forbidden' });
return;
}
</code>
<code>export const createSomethingHttp = onRequest(async (request, response) => {
// Check if the request is from Cloud Tasks
if (!request.headers['x-cloudtasks-queuename']) {
logger.error('Request not from Cloud Tasks', request.headers);
response.status(403).json({ error: 'Forbidden' });
return;
}
</code>
export const createSomethingHttp = onRequest(async (request, response) => {
// Check if the request is from Cloud Tasks
if (!request.headers['x-cloudtasks-queuename']) {
logger.error('Request not from Cloud Tasks', request.headers);
response.status(403).json({ error: 'Forbidden' });
return;
}
Currently, this is my guard, but if could be easily bypass.
Is there a way to modify this code to verify the origin of the request ?
Functions & Cloud Tasks are on the same project and same location.
Many thanks
I have found several answers online about OIDC tokens, I wasn’t able to understand it properly, I think because of lack of experience and expertise, especially the answers in different coding language. I think it requires also several changes in the GCP account / service accounts. I’m looking to see if there is a way from code-side.
Recognized by Google Cloud Collective